| タイトル | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling |
|---|
| 説明 | Summary
An attacker alternates long idle periods with short, intense bursts of events. Time-windowed rate detection averages the bursts away, so the pattern stays below thresholds while still consuming CPU and degrading service, with the potential to reach total DoS during burst peaks under high valid traffic.
Vulnerability
Rate/anomaly detection uses time-averaged windows. A sleep phase (>5 s) followed by a sub-second burst keeps the windowed average under threshold, so bursts are never flagged. The collector processes each burst at full cost, causing transient CPU spikes and degradation that detection misses.
Discovery
A sleep phase >5 s followed by a burst of events in <1 s stays below detection thresholds yet causes service degradation/denial by consuming CPU during the burst.
Expected Behavior
The collector should detect temporal burst patterns combined with event similarity (burstiness, not just average rate) and throttle or alert on the repeating idle -> burst signature.
Actual Behavior
Because events are spread over long periods, the windowed average stays below threshold; the collector accepts bursts without alerting. Degradation is achieved, with potential for total DoS during peaks under high valid traffic.
Impact
- Degradation / Denial of Service (availability) during burst windows.
- Hard to detect - events spread over time defeat average-rate thresholds.
Issue: https://lf-o-ran-sc.atlassian.net/browse/SMO-204
Exploit: https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587
Steps to Reproduce
1. Deploy O-RAN-SC SMO/OAM L-Release with a reachable `ves-collector`.
2. From the downloaded gist-scripts:
```bash
cd ../Scripts
# Default: 2 sources, 5-event burst, then sleep BURST_WAITING_TIME (10s).
python3 sleeper_attack.py
# Mirror the \">5s idle, <1s burst\" discovery condition:
BURST_WAITING_TIME=6 THREAD_COUNT=2 python3 sleeper_attack.py
```
3. Observe CPU spikes during each burst while no rate/anomaly alert fires.
Remediation
- Add burstiness detection (e.g. peak-rate / coefficient-of-variation over short sub-windows) in addition to average-rate thresholds.
- Apply short-window token buckets so a sub-second burst is capped even when the long-window average is low.
- Correlate repeating idle -> burst signatures per source over longer horizons.
Detection
- Alert on short-window peak event rate per source exceeding a cap.
- Track inter-arrival-time variance; flag periodic idle→burst signatures.
- Monitor transient CPU spikes that align with bursty per-source arrivals.
|
|---|
| ソース | ⚠️ https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587 |
|---|
| ユーザー | fklement (UID 100684) |
|---|
| 送信 | 2026年08月21日 12:34 (28 日 ago) |
|---|
| モデレーション | 2026年09月17日 19:06 (27 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 406596 [O-RAN-SC SMO OAM 2025-06-10 VES Collector サービス拒否] |
|---|
| ポイント | 20 |
|---|